Both routers: sshd takes keys only (it is reachable from the open TollGate
SSID, and on the Pi from the WAN); shared %router-sysctls in router-base
(no ICMP redirects taken, loose rp_filter, kptr_restrict, BPF JIT hardened).
MT6000: the lab WAN SSH rule is gone; 99_zz-wired-private (a uci-defaults
script, after TollGate's setup) moves lan1-lan5 into TollGate's private
network (192.168.2.1), leaves br-lan to the open SSID, rejects SSH/telnet/
LuCI from it, trims nodogsplash's router ports, and turns on the private
network's DHCP, which TollGate's setup left disabled (PITFALLS #55).
The kernel has CONFIG_NFT_FLOW_OFFLOAD; fw4's offloading was measured and
is left off -- no gain at line rate, and it would let flows bypass
nodogsplash's session enforcement (PITFALLS #56). Deployed as MT6000
generation 6.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
